From 997918e2f71d2b9a8a4fd44d15f4f1c3e3d4a2c9 Mon Sep 17 00:00:00 2001
From: beatzaplenty <wayne.bennett@live.com>
Date: Sun, 26 Jul 2026 11:07:51 +1000
Subject: [PATCH] feat(beszel): add beszel agent to tailscale-router
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Wires beszel-agent into all tailscale-router variants (lxc/linode/proxmox)
by importing enable-agent.nix in the build type and host-token.nix in the
host file. Adds the sops creation rule for secrets/tailscale-router.yaml
(all three platform variants as recipients). The secrets file must be
created manually before deploying — see instructions in PR.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .sops.yaml                               |  8 ++++++++
 hosts/tailscale-router/host.nix          | 11 +++++++++++
 modules/build-types/tailscale-router.nix |  1 +
 3 files changed, 20 insertions(+)

diff --git a/.sops.yaml b/.sops.yaml
index 02565e0..b37b4e2 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -77,6 +77,14 @@ creation_rules:
           - *admin
           - *lxc-tor-relay
 
+  - path_regex: secrets/tailscale-router\.yaml$
+    key_groups:
+      - age:
+          - *admin
+          - *linode-tailscale-router
+          - *lxc-tailscale-router
+          - *proxmox-tailscale-router
+
   # gui-host-specific secrets (currently: wifi-password, see
   # modules/networking/wifi.nix). Only *lxc-gui has a registered key today
   # -- proxmox-gui/linode-gui/baremetal-gui haven't been provisioned via
diff --git a/hosts/tailscale-router/host.nix b/hosts/tailscale-router/host.nix
index b6ba534..d5b09f1 100644
--- a/hosts/tailscale-router/host.nix
+++ b/hosts/tailscale-router/host.nix
@@ -1,8 +1,19 @@
 _:
 
 {
+  imports = [
+    (import ../../modules/beszel/host-token.nix {
+      name = "tailscale-router";
+      sopsFile = ../../secrets/tailscale-router.yaml;
+    })
+  ];
+
   networking.hostName = "tailscale-router";
 
+  services.beszel.agent.environment = {
+    KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
+  };
+
   # No networking.hostId: only ZFS-touching hosts (server, docker) need one
   # for pool-import safety, and this host does neither.
 
diff --git a/modules/build-types/tailscale-router.nix b/modules/build-types/tailscale-router.nix
index 764ef38..fd8059f 100644
--- a/modules/build-types/tailscale-router.nix
+++ b/modules/build-types/tailscale-router.nix
@@ -3,6 +3,7 @@
 {
   imports = [
     ../tailscale/subnet-router.nix
+    ../beszel/enable-agent.nix
   ];
 
   # "server", not "both": this build type advertises LAN subnet routes but
-- 
2.54.0